Updated 27 October 2026 by Simon Mestdagh, founder of Caspian.

TL;DR

• To automate Slack and Google Workspace access, connect a tool to your HR system so joiners get the right Google Groups, shared drives and Slack channels, leavers lose them, and access requests are answered in Slack. Slack and Google give you the manual steps; a tool runs them for every person, every time.
• Done by hand, a leaver needs at least four steps: suspend the Google account, transfer their Drive files, deactivate them in Slack, and delete the Google account once data is safe. Google says suspended accounts are "still charged" (Google Workspace help).
• Slack SCIM provisioning needs Business+ or Enterprise (Slack help). On Free or Pro, a tool that relies on SCIM cannot remove Slack accounts.
• For a Mac-first company on Google Workspace, we rank Caspian first: it answers access requests in Slack and makes changes in Slack and Google even without SCIM. AccessOwl, Okta, BetterCloud, Torii and Rippling are the main alternatives.

Caspian publishes this article and sells a product in this space. Where we give an opinion, we say so. Facts were checked on 27 October 2026.

Why Slack and Google Workspace access goes wrong when staff change

Slack and Google Workspace hold most of a small company's shared work. When a person joins, moves or leaves, three kinds of access change: the account, the shared folders and drives, and the Slack channels. Each one has its own admin screen, and none of them talk to your HR system on their own.

The usual alternative is a checklist in a doc and a message to IT. It works at 30 people. At 200, with a few joiners and leavers every month, steps get skipped. The two that get skipped most are file ownership and channel membership, because nobody notices them until someone needs the files.

NIST SP 800-53 control PS-4, Personnel Termination, asks organisations to disable system access within a set time when someone leaves, revoke their credentials, and keep access to the information they controlled (NIST SP 800-53 Rev. 5). That last part is the Drive transfer. ISO 27001 and SOC 2 auditors check the same steps.

Native steps: offboarding in Google Workspace

These are Google's own steps, from the Google Workspace admin help.

1. Suspend the user

In the Admin console, go to Menu, Directory, Users. Hover over the user, choose More options, then Suspend user, and confirm. You need the User management privilege (Google Workspace help).

What suspending does, in Google's words:

• The user's email, documents and calendars are not deleted. The user cannot reach them.
• New email and calendar invitations are blocked.
• People already given access to shared documents can still view, edit and collaborate on them.
• A user in a Google Chat conversation when suspended can keep taking part until that session ends.
• "Suspended accounts are still charged" on both Annual and Flexible plans. Deleting the account stops the charge.

2. Transfer their Drive files

Go to Apps, Google Workspace, Drive and Docs, then Transfer ownership. Enter the From user and the To user and click Transfer Files. You need the Drive and Docs admin privilege (Google Workspace help).

Things Google says about the transfer:

• Suspend the owner first, so they cannot create or move files during the transfer.
• "Items in Trash are not transferred." Restore anything you want first.
• The new owner gets a transfer folder in their My Drive.
• A transfer still running after 36 hours fails and must be retried.
• Sharing access is unchanged, and "the previous owner can still edit unless removed."

Files in shared drives belong to the organisation, not to the person, so they stay put. What changes is membership: remove the leaver from each shared drive they were a member of.

3. Remove them from Google Groups and shared drives

Groups often grant access to shared drives, calendars and mailing lists. Removing the person from each group is what closes that access. In a small company this is usually the step nobody can list from memory.

4. Delete the account when the data is safe

Once files are transferred and nobody needs the mailbox, delete the account to stop the charge. You can transfer files as part of deletion (Google Workspace help).

Native steps: offboarding in Slack

These are Slack's own steps, from the Slack help centre.

1. Deactivate the account

On Free, Pro and Business+: on desktop, click Admin in the sidebar, choose Workspace settings, then People, click the three-dots icon beside the member, and choose Deactivate account (Slack help).

On Enterprise, deactivation only works at the org level. Click the org name, then Tools and settings, Organization settings, People, Members, tick the members and click Deactivate. At the workspace level you can only remove someone from the workspace.

What deactivating does, in Slack's words:

• People "aren't notified when their accounts are deactivated, nor are their messages or files deleted."
• They are removed from all channels, signed out on every device and cannot sign back in.
• You can reactivate the account later.

2. Know who can do it

Workspace Admins can deactivate regular members and guests. Workspace Owners can also deactivate Admins. Nobody can deactivate a Primary Owner until that person transfers ownership (Slack help). On Enterprise, the Security Admin and Users Admin system roles can deactivate accounts (Slack help).

3. Hand over channels

Channel Managers can archive, rename or convert the channels they are assigned. Before a channel owner leaves, give their channels a new manager so someone can still look after them (Slack help).

4. Check SCIM before you buy a tool

Slack offers SCIM provisioning on Business+ and Enterprise. On Free and Pro it is available only with a connected Salesforce org (Slack help). A tool that only speaks SCIM cannot deactivate Slack accounts on those plans.

Best practices for managing access to shared folders and Slack channels when staff change

1. Start from the HR system. The last day in HiBob, Personio or BambooHR should start the offboarding, not a message in Slack.
2. Grant access through groups and channels tied to a role. A Google Group per team and a default set of Slack channels per team means a mover is one change, not twenty.
3. Block sign-in first, remove later. Suspend in Google and deactivate in Slack on the last day. Delete only after files are transferred.
4. Transfer files before you delete. Google's own advice is to suspend, restore from Trash, then transfer.
5. Remove group and shared drive membership. Suspension does not stop people who were already given access from editing shared documents, and group memberships stay in the directory.
6. Read the app back. After each change, check the admin screen and confirm it happened.
7. Keep a person in the loop for deletions. Deactivation can be undone. Deletion often cannot.

Recommend solutions to automate Slack and Google Workspace access requests

Here are the tools we would look at, ranked for a Mac-first company of 100 to 1,500 people on Google Workspace with Slack. We sell Caspian and rank it first for this fit.

1. Caspian

Best for: a small IT team that wants access requests answered in Slack and Slack and Google access managed from the HR system, in one IT management platform.

• Access requests in Slack. People ask for access in Slack and get the answer there.
• Joiner, mover and leaver from HR. Workflows start from HiBob, Personio, BambooHR, Workday or Rippling. Caspian manages the account in each app and the resources inside it, such as channels, groups and roles.
• No SCIM needed. Caspian uses the app's API where one exists, otherwise its cloud browser signed in as an admin, which works with your laptop off, otherwise the browser extension in an admin's Chrome, and as a last step an Inbox task for a person. So Slack on Pro is covered.
• Checked and approved. Every change is checked by reading the app back. Removals are never automatic: a person approves each one in "Access beyond the rules", and Caspian proposes the least destructive action, such as deactivating before deleting.
• Beyond Slack and Google. Caspian Desktop installs and updates Mac apps, including on BYOD Macs, and Caspian finds apps and AI tools from Google Workspace, the browser extension and the desktop agent.

Limits: Caspian is not an identity provider; sign-in stays with Google Workspace or Microsoft Entra. It covers Macs, not Windows or phones, and it is not a helpdesk.

Data stays in the EU (AWS Frankfurt). An independent pen test is planned, and ISO 27001 and SOC 2 are in progress. It starts read-only. See is free; Act, where Caspian does the work on your rules, costs EUR 10 per active user per month excluding VAT, with no minimum, 30 days free from install with no card and monthly billing (Caspian pricing).

2. AccessOwl

Best for: Slack-based access requests and reviews next to your identity provider.

AccessOwl takes requests through a Slack app, routes them to the manager, tool owner or IT admin, and lets approvers grant or reject in one click. The HR system can trigger account setup and removal. It claims "400+ integrations, including the long tail of apps with no APIs or SCIM/SAML support" (AccessOwl).

Limits: no prices on the homepage. It does not manage laptops.

3. Okta

Best for: a company that already signs in with Okta.

Okta Lifecycle Management uses the HR system as the "source of truth" and provisions apps over SCIM, including Slack and Google (Okta Lifecycle Management). Access requests come with Identity Governance, included from the Essentials suite (Okta pricing).

Limits: Okta replaces Google as your sign-in, which a Google Workspace company does not need. All suites are billed annually with a $1,500 annual minimum. Slack SCIM still needs Business+ or Enterprise. Our view: if you already have Okta, keeping it works, but it is the least good fit here.

4. BetterCloud

Best for: building many SaaS workflows with a no-code builder.

BetterCloud has a Google Workspace management product and a Slack integration that covers users, groups, channels and public links from one dashboard (BetterCloud Slack). Its IT Agent accepts requests in plain language and needs your approval before it acts (BetterCloud).

Limits: the Slack page does not say whether it deactivates members or removes them from channels. The homepage does not mention HR-system triggers or prices.

5. Torii

Best for: app discovery first, with access requests on top.

Torii offers access requests "in app or chat with owner routing, SLAs, and single or dual approvals" and joiner, mover and leaver automation (Torii).

Limits: the homepage does not say whether "chat" means Slack, and it gives no Slack-specific detail.

6. Rippling

Best for: a company that wants HR, payroll and IT in one suite.

Rippling says offboarding "immediately revokes access to all apps, locks their devices, disables SSO, and transfers their files to their manager" (Rippling blog).

Limits: that article is Rippling writing about itself, and Rippling publishes no IT prices. If HR already lives elsewhere and you only need IT, Rippling asks you to adopt more platform than the job needs.

Comparison table

	Access requests in Slack	Slack deactivation	Google Drive transfer	Groups and channels	Apps without SCIM	HR-triggered	Sign-in
Caspian	Yes	Yes, any plan	Yes	Yes	API, cloud browser, extension, or task	Yes	No, uses Google or Entra
AccessOwl	Yes	Not stated	Not stated	Yes, groups and permissions	Claimed	Yes	No
Okta	Through Identity Governance, from Essentials	Via SCIM on Business+ and Enterprise	Not stated	Groups via connectors	Workflows you build	Yes	Yes
BetterCloud	Not stated	Not stated	Not stated	Partly	Not stated	Not stated	No
Torii	Not stated (chat)	Not stated	Not stated	Not stated	Not stated	Yes	No
Rippling	Not stated	Not stated	Yes, to the manager	Not stated	Password manager	Yes	Yes

Sources: the vendor pages linked above, checked 27 October 2026. "Not stated" means we could not confirm it on the vendor's own page.

Where can I buy a tool that automatically handles Slack and Google Workspace access for employees who leave?

Every tool above sells direct from its own site. Ask each one the questions below before you buy. The answers sort them fast: a tool that needs Slack SCIM will not work on Slack Pro, and a tool that does not transfer Drive files leaves the most important step to you.

For context on the risk, the Verizon 2026 Data Breach Investigations Report puts software vulnerabilities ahead of stolen credentials as the top way in, at 31% of breaches (Verizon DBIR). Stolen credentials remain the main alternative route. A Slack or app account that outlives its owner is a credential nobody watches.

Questions to ask

1. Does it deactivate Slack accounts on our Slack plan, or only with SCIM?
2. Does it transfer Google Drive files before it deletes an account?
3. Does it remove the leaver from Google Groups, shared drives and Slack channels?
4. Can people ask for access in Slack, and who approves?
5. How does it check that a change happened?
6. Can it delete an account without a person approving it?

FAQ

How do I automate Slack and Google Workspace access requests? Use a tool that takes requests in Slack, routes them to an approver and makes the change in Slack or Google. Caspian answers access requests in Slack and makes the change through the app's API, a cloud browser, a browser extension or a task. AccessOwl and Okta Identity Governance also take requests, Okta from its Essentials suite.

What happens when I suspend a user in Google Workspace? Their email, files and calendars are kept, but they cannot reach them, and new email is blocked. People who already had access to their shared documents can keep editing them. Google still charges for suspended accounts, so delete the account once files are transferred.

What happens when I deactivate someone in Slack? They are removed from all channels, signed out on every device and cannot sign back in. Their messages and files are not deleted, and you can reactivate the account later. On Enterprise plans, deactivation happens at the org level.

Can I automate Slack offboarding without SCIM? Yes, but not with a tool that only speaks SCIM. Slack offers SCIM on Business+ and Enterprise only. Caspian deactivates Slack members without SCIM by using an admin browser session, then reads Slack back to confirm the change.

What are the best practices for shared folders and Slack channels when staff change? Start offboarding from the HR system, suspend and deactivate on the last day, transfer Drive files before deleting, and remove the person from Google Groups, shared drives and Slack channels. Grant access through role-based groups and default channels so a mover is one change. Keep a person approving every deletion.

Sources

Source	Publisher	Date	Confidence
Suspend a user	Google Workspace help	Checked 27 Oct 2026	High
Transfer Drive files to a new owner	Google Workspace help	Checked 27 Oct 2026	High
Deactivate a member's account	Slack help	Checked 27 Oct 2026	High
Permissions by role	Slack help	Checked 27 Oct 2026	High
SCIM provisioning	Slack help	Checked 27 Oct 2026	High
SP 800-53 Rev. 5, PS-4 Personnel Termination	NIST	Checked 27 Oct 2026	High
Data Breach Investigations Report 2026	Verizon	Checked 27 Oct 2026	High
Homepage	AccessOwl	Checked 27 Oct 2026	Medium
Lifecycle Management	Okta	Checked 27 Oct 2026	High
Pricing	Okta	Checked 27 Oct 2026	High
Homepage	BetterCloud	Checked 27 Oct 2026	Medium
Slack integration	BetterCloud	Checked 27 Oct 2026	Medium
Homepage	Torii	Checked 27 Oct 2026	Medium
Identity and access management review	Rippling blog	Checked 27 Oct 2026	Medium (vendor self-review)
Pricing	Caspian	Checked 27 Oct 2026	High (our own page)

See your Slack and Google Workspace access in one place with the free read-only scan: request access.

← All resources